From nobody Mon Sep 28 11:41:16 2026 Received: from www2881.sakura.ne.jp (www2881.sakura.ne.jp [49.212.198.91]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 30208395ACB for ; Sat, 22 Aug 2026 12:36:07 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=49.212.198.91 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1787402169; cv=none; b=ZZtdaPitgC/wwPZSx7fHh1RO5rIk8h1cE8n33A3OEGfgJzrA7R6COfTWtIhJ5e3Z5X7p0xJO4j0Sq7mJ8S92O+5gu7A6TFJ1h3LKiIYSNFereDtBt1/5pQHnlCBbW42y+8KgPJntxLQAc7T88ZFXog/7S7pySz9iB729s6lTsos= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1787402169; c=relaxed/simple; bh=eiZH4AX7ndPQmcztoeMabpWn4SysFZTSe/JF0S9/i5c=; h=From:Date:Subject:MIME-Version:Content-Type:Message-Id:To:Cc; b=c1ycjgFO1tYlHbZdWRGIF+YbqZZry8WPiS42+ifieDwvJCrlY4YOJQQrpYdrE44VU/HVuhpTEuwBx6LH1Le4cdeEH5pjeaD1GAjaSOTqryREEXK8BW68kxfqu7ut8Tl3y/gJ3NAv4AxEMe4CD2QjlLPd+OZ/oVilU4IQJWgSEtE= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=enjuk.jp; spf=pass smtp.mailfrom=enjuk.jp; dkim=pass (2048-bit key) header.d=enjuk.jp header.i=@enjuk.jp header.b=Qi8tz5dC; arc=none smtp.client-ip=49.212.198.91 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=enjuk.jp Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=enjuk.jp Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=enjuk.jp header.i=@enjuk.jp header.b="Qi8tz5dC" Received: from [192.168.0.128] (KD106146213223.au-net.ne.jp [106.146.213.223]) (authenticated bits=0) by www2881.sakura.ne.jp (8.16.1/8.16.1) with ESMTPSA id 67MCZKoq065543 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NO); Sat, 22 Aug 2026 21:35:37 +0900 (JST) (envelope-from kohei@enjuk.jp) DKIM-Signature: a=rsa-sha256; bh=rpvT8hnQERFATy0874YF4+iV9lW7F3bW6BUay96Squg=; c=relaxed/relaxed; d=enjuk.jp; h=From:Message-Id:To:Subject:Date; s=rs20251215; t=1787402137; v=1; b=Qi8tz5dCtR5Z3BtkPslgUC6fm/8nycT7JpRGC0TcfvdqtFhYve98ohUSYDzZolNj YyhOBDFF3tLtEDEWw4zhgWfRZk9+PKa2Sf6KIlQHckAjZpZokDCiU5WbN2AyNNEP VhGvcoeCwlW7d5tAE+P4kZfVZXQqhRFGMXN9Lhcn9lNv76lR7OzaP1ZZKQVHMDls gMippw31BydoDODRHVn1bTjK1T1+TNkWdXWXlBkdHaP/qUo+0Tt1bLz9Nnwd5v1p XPE5ebz2AgOrl4kyIV558I3fH7w8YT3enrP81jz4BSPJtUBhjhv/mNliQrXynCYM NxuzYGbpEVUsqYQFGX3Zkg== From: Kohei Enju Date: Sat, 22 Aug 2026 21:35:03 +0900 Subject: [PATCH] virt: sev-guest: Fix lifetime of message descriptor Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Message-Id: <20260822-sev-guest-mdesc-lifetime-v1-1-b489d434796c@enjuk.jp> X-B4-Tracking: v=1; b=H4sIAAAAAAAC/x3MQQqDQAxG4atI1gZiKFV6FelCnV8bqFomOhTEu zu4/BbvHeSIBqdXcVBEMrd1yajKgoZPt0xgC9mkok9pVNmReNrhG88BPvDXRmw2gyFNXWsvlYQ H5fwXMdr/Xrfv87wAives4GoAAAA= X-Change-ID: 20260822-sev-guest-mdesc-lifetime-e08772b010d4 To: Tom Lendacky , Dan Williams , Nikunj A Dadhania , "Borislav Petkov (AMD)" Cc: linux-kernel@vger.kernel.org, Kohei Enju X-Mailer: b4 0.14.3 sev_guest_probe() registers the TSM provider before assigning snp_dev->msg_desc. Once the provider is registered, a concurrent configfs report request can reach get_ext_report() and dereference a NULL message descriptor. Additionally, sev_guest_remove() frees the message descriptor before the managed TSM unregister action runs, allowing the provider to access the freed descriptor. Assign snp_dev->msg_desc before registering the TSM provider. Add a managed cleanup action for the message descriptor before adding the TSM unregister action. Since devres actions run in LIFO order, the TSM provider is unregistered before the message descriptor is freed both during probe failure and driver removal. Fixes: f47906782c76 ("virt: sevguest: Add TSM_REPORTS support for SNP_GET_E= XT_REPORT") Fixes: 0a895c0d9b73 ("virt: sev-guest: Carve out SNP message context struct= ure") Signed-off-by: Kohei Enju Reviewed-by: Nikunj A Dadhania Reviewed-by: Tom Lendacky --- drivers/virt/coco/sev-guest/sev-guest.c | 26 +++++++++++++++----------- 1 file changed, 15 insertions(+), 11 deletions(-) diff --git a/drivers/virt/coco/sev-guest/sev-guest.c b/drivers/virt/coco/se= v-guest/sev-guest.c index 935537a41469..458c96fd82f3 100644 --- a/drivers/virt/coco/sev-guest/sev-guest.c +++ b/drivers/virt/coco/sev-guest/sev-guest.c @@ -618,6 +618,11 @@ static struct tsm_report_ops sev_tsm_report_ops =3D { .report_bin_attr_visible =3D sev_report_bin_attr_visible, }; =20 +static void free_snp_msg(void *data) +{ + snp_msg_free(data); +} + static void unregister_sev_tsm(void *data) { tsm_report_unregister(&sev_tsm_report_ops); @@ -644,9 +649,15 @@ static int __init sev_guest_probe(struct platform_devi= ce *pdev) if (IS_ERR_OR_NULL(mdesc)) return -ENOMEM; =20 + ret =3D devm_add_action_or_reset(&pdev->dev, free_snp_msg, mdesc); + if (ret) + return ret; + ret =3D snp_msg_init(mdesc, vmpck_id); if (ret) - goto e_msg_init; + return ret; + + snp_dev->msg_desc =3D mdesc; =20 platform_set_drvdata(pdev, snp_dev); snp_dev->dev =3D dev; @@ -661,32 +672,25 @@ static int __init sev_guest_probe(struct platform_dev= ice *pdev) =20 ret =3D tsm_report_register(&sev_tsm_report_ops, snp_dev); if (ret) - goto e_msg_init; + return ret; =20 ret =3D devm_add_action_or_reset(&pdev->dev, unregister_sev_tsm, NULL); if (ret) - goto e_msg_init; + return ret; =20 ret =3D misc_register(misc); if (ret) - goto e_msg_init; + return ret; =20 - snp_dev->msg_desc =3D mdesc; dev_info(dev, "Initialized SEV guest driver (using VMPCK%d communication = key)\n", mdesc->vmpck_id); return 0; - -e_msg_init: - snp_msg_free(mdesc); - - return ret; } =20 static void __exit sev_guest_remove(struct platform_device *pdev) { struct snp_guest_dev *snp_dev =3D platform_get_drvdata(pdev); =20 - snp_msg_free(snp_dev->msg_desc); misc_deregister(&snp_dev->misc); } =20 --- base-commit: 26260251022fbc2f248a3d747a9b2b961b18d2d8 change-id: 20260822-sev-guest-mdesc-lifetime-e08772b010d4 Best regards, --=20 Kohei Enju